Skip to main content
Guidance

Hepatitis C National Register privacy information

Updated 13 June 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/hepatitis-c-national-register/hepatitis-c-national-register-privacy-information

About the UK Health Security Agency (UKHSA)

The UKHSA is an executive agency of the Department of Health and Social Care (DHSC). We are responsible for protecting the nation from the impact of infectious diseases and other external health threats through scientific, operational and public health leadership in the UK and globally.

We collect and use personal information to fulfil our remit from the government, including operating the Hepatitis C National Register. The register collects information on individuals in the UK diagnosed with hepatitis C at a known date or time window, and on individuals who may have been exposed to the virus but are not diagnosed. This supports understanding of health outcomes, modelling estimates of the current and future burden of hepatitis C virus infection, informing national policy and healthcare planning, and assessing the impact of available treatments.

This privacy notice explains how we collect and use personal information for individuals enrolled onto the Hepatitis C National Register and outlines your information rights and how to raise concerns.

The DHSC is the data controller for the personal information we collect, store and use to fulfil our remit.

The information we collect

We collect information on individuals enrolled in the Hepatitis C National Register. These individuals are identified in the following ways:

  • patients identified during the National Hepatitis C Lookback programme (1995), including those found to be positive for hepatitis C and approximately 475 individuals who tested negative for hepatitis C antibodies; the programme identified recipients of blood or blood components from donors later found to have tested positive for hepatitis C, who donated before testing was introduced in 1991
  • patients who donate blood and test positive for hepatitis C and who have a previous negative hepatitis C test within the previous four-year period
  • patients who acquired their hepatitis C infections in childhood or adolescence

The personal information we collect and use includes:

  • demographic information: including surname and initials, date of birth, sex, ethnic group, country of birth, NHS number and hospital number
  • medical information, including:
    • hepatitis C treatments, blood tests, fibroscan results, and other investigations carried out as part of hepatitis C management
    • symptoms of liver disease
    • general health information (for example body mass index, drug use, and alcohol consumption)
    • cancer diagnoses and information from death registrations
    • spare sections from liver biopsies (where available) and information from our analyses
    • leftover blood samples from previous tests (where available) and information from our analyses

How we collect information

When someone is first enrolled into the Hepatitis C National Register, UKHSA collect this personal information from their consultant or general practitioner (GP). We update this information every 3 to 5 years by completing a follow-up with their consultant or GP.

We also collect cancer diagnoses and death information from the national health organisations listed below. To enable this, we share limited personal information (NHS number, initials and date of birth) with these organisations. This information comes from:

  • NHS England (for patients in England and Wales)
  • National Cancer Registry for Wales
  • General Register Office for Northern Ireland
  • NHS Central Register for Scotland

Where available, we also collect spare blood and liver biopsy samples from the hospital treating the patient for hepatitis C.

The purposes we use information for

We use this information to understand how hepatitis C affects people over time, including how liver disease develops and how people respond to treatment.

We use the information to:

  • identify which groups of people with hepatitis C are at greatest risk of developing liver disease
  • compare the death rates among people who acquired their hepatitis C infection via a blood transfusion with others who received a transfusion but were not exposed to hepatitis C and did not acquire the infection
  • monitor how disease caused by hepatitis C progresses over time
  • develop mathematical models that predict current and future levels of hepatitis C-related disease, which supports healthcare planning, and informs efforts to eliminate hepatitis C as a public health threat by 2030

The results of this work are included in reports and research studies available to the NHS, health service commissioners and the public. We also provide newsletters to GPs and consultants whose patients are enrolled on the register.

Results from our analysis help doctors provide better information to individuals about the infections they have and how best to prevent and manage them.

How we protect information

The personal information used by the Hepatitis C National Register is protected in several ways:

  • it is stored on computer systems that are regularly tested and kept up to date to protect them from viruses and hacking
  • it is only accessible to staff who are trained to protect patient privacy
  • where we share personal information with other organisations, we use secure computer systems or encrypted email
  • whenever possible, we use personal information in a form that does not directly identify an individual; we do not hold individuals’ name or address on the register, only initials
  • we do not publish information that could identify individuals in the register

Where we store personal information

All personal information used by the Hepatitis C National Register is stored securely in the UK.

Who we share personal information with

We may share personal information held in the Hepatitis C Register with other organisations. If we do share this personal information, we only do so where the law allows and we only share the minimum necessary amount of information.

We may share personal information with university and other accredited researchers who apply to access it. All applications are reviewed by the Hepatitis C National Register Steering Group to ensure that the information will only be used to help improve our understanding of how to better prevent and treat hepatitis C. If approved, an appropriate governance agreement will be put in place and they will only be provided with information that cannot be used to identify individuals. For example, we remove details such as patient initials and replace date of birth with age.

Infected Blood Inquiry (IBI)

We also share information from the Hepatitis C National Register with the IBI. The IBI is an independent public inquiry examining how people treated by UK national health services were given infected blood and infected blood products, in the 1970s and 1980s. We share relevant information to support the Inquiry’s work, in line with legal requirements. You can find out more about the inquiry on the IBI website.

How long we keep personal information

The personal information used by the Hepatitis C National Register is kept for an individual’s lifetime and after death, for as long as it is needed for public health research and monitoring or otherwise required by law.

The information needs to be kept for this long because hepatitis C is a long-term condition that affects the health of infected people across their lifetime. For example, the average time between infection and outcomes such as liver cancer can take up to 30 or 40 years. Long term data is therefore needed to understand these outcomes over time and to improve the services provided to prevent and treat hepatitis C.

We keep information for all individuals for the same length of time so we can compare outcomes fairly between people with and without hepatitis C.

If we change how long we keep information, we will update this privacy notice.

Your rights over your personal information

If you are included in the National Hepatitis C Register, you have a number of rights over your personal information. You have the right to:

  • ask for a copy of any information we hold about you
  • ask for any information we hold about you that you think is inaccurate to be changed
  • ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate
  • object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information: we will tell you why if this is the case
  • delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information: we will tell you why if this is the case
  • ask us not to use your information to make automated decisions about you without the involvement of one of our staff

You can exercise any of these rights by contacting UKHSA at:

Information Rights Team
UKHSA
5th Floor, 10 South Colonnade
London E14 4PU
Email: InformationRights@UKHSA.gov.uk

The relevant legal bases we rely on to process your personal information under the UK General Data Protection Regulation (UK GDPR) are:

  • Article 6(1)(e): tasks carried out in public interest
  • Article 9(2)(i): public health

We also have approval from the Secretary of State for Health and Social Care under section 251 of the NHS Act 2006 to use confidential patient information without consent, for public health purposes.

How to find out more or raise a concern

If you have any general enquiries regarding the Hepatitis C National Register, you can contact us at hepatitis@ukhsa.gov.uk

If you have any concerns about how personal information is used and protected by UKHSA, you can contact the DHSC’s Data Protection Officer at data_protectionofficer@dhsc.gov.uk or by writing to:

Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London SW1H 0EU

You also have the right to contact the Information Commissioner’s Office (ICO) if you have any concerns about how UKHSA uses and protects any personal information it holds about you. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at ico.org.uk or by writing to:

Customer contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

About this privacy information

The personal information we collect and use may change so we may need to revise this notice. If we do, the publication date on this page will change.

For more information, please also see the UKHSA privacy notice.

Back to top